NSE7 Practice Test 31 — 15 Questions

Question 1

Which Fortinet product is designed specifically to detect and deceive attackers by creating decoy systems and luring them away from real assets?

Accepted Answer

FortiDeceptor. FortiDeceptor is Fortinet's dedicated deception-based threat detection solution. It creates realistic decoy systems (honeypots) and lures attackers away from real assets, providing early detection and threat intelligence without relying on signatures. This aligns with the question's specific requirement for a product designed to detect and deceive attackers using decoys.

Answer

FortiSandbox

Answer

FortiEDR

Answer

FortiWeb

Question 2

A company is deploying ZTNA to replace their legacy VPN. They want to ensure that only users with a valid certificate and compliant antivirus can access the internal application. Which TWO components are required on the FortiGate for this deployment?

Accepted Answer

ZTNA proxy rule with access proxy. Option A is correct because the ZTNA proxy rule with an access proxy is the FortiGate component that publishes the internal application and enforces the ZTNA access proxy, which is where client certificate authentication and device posture (such as compliant antivirus) are validated before traffic is allowed. Option C is correct because a firewall policy with ZTNA tags matching is required to permit and control the traffic from ZTNA-authenticated users, using the dynamic ZTNA tags that FortiClient EMS assigns based on certificate and antivirus compliance. Together, the access proxy handles the ZTNA authentication and posture check, while the firewall policy with ZTNA tag matching authorizes the session to the internal application. Option B is not required because BGP is a dynamic routing protocol unrelated to ZTNA access control. Option D is not required because SSL-VPN portal is the legacy VPN feature being replaced by ZTNA. Option E is not required because IPsec phase1 with certificate authentication is a site-to-site or remote VPN tunnel mechanism, not the ZTNA access proxy enforcement used here.

Answer

Dynamic routing protocol (BGP)

Answer

SSL-VPN portal

Answer

IPsec phase1 with certificate authentication

Question 3

In FortiManager, what is the difference between a Global ADOM and a regular ADOM?

Accepted Answer

Global ADOM allows sharing of global objects across all ADOMs. In FortiManager, a Global ADOM is a special administrative domain that stores global objects (such as address objects, services, and policies) that can be shared and referenced by all regular ADOMs. This centralizes management of common resources, reducing duplication and ensuring consistency across multiple ADOMs. Regular ADOMs are isolated from each other by default, but they can import objects from the Global ADOM, which is the key distinction.

Answer

Regular ADOM supports automation stitches while Global ADOM does not

Answer

Regular ADOM can only manage one FortiGate

Answer

Global ADOM is used for managing FortiGates in a single VDOM environment

Question 4

You run 'diagnose vpn ike gateway list' and see the following:
gateway name: HUB_GW
  version: IKEv2
  state: UP
  mode: main
  local: 10.0.0.1:500
  remote: 203.0.113.5:500
  auth: psk
  dpd: on
  rekey: 86400
  num_peers: 2
  total_tunnels: 2
  auto-discovery: enabled
What does the 'auto-discovery: enabled' indicate about this VPN gateway?

Accepted Answer

The gateway is acting as an ADVPN hub and will advertise routes to spokes for shortcut tunnel creation. In FortiOS, 'auto-discovery: enabled' on an IKE gateway indicates the gateway is operating as an ADVPN (Auto-Discovery VPN) hub. The hub advertises learned spoke routes to other spokes via IKE, enabling them to establish dynamic shortcut tunnels directly with each other instead of hairpinning traffic through the hub. This is the defining behavior of an ADVPN hub in the 'diagnose vpn ike gateway list' output.

Answer

The gateway will automatically create new phase2 selectors for any remote subnet

Answer

The gateway will automatically renegotiate IKEv2 keys before expiration

Answer

The gateway will discover other VPN gateways on the same network and form peer relationships

Question 5

An administrator configures a firewall policy with an application control profile to block social media. The administrator observes that some social media traffic is still passing through. The traffic is HTTPS. What additional configuration is REQUIRED for application control to effectively block HTTPS-based social media?

Accepted Answer

Enable 'ssl-ssh-profile' with deep inspection on the policy. Application control requires visibility into the application layer to identify HTTPS-based traffic. Without SSL inspection, the firewall cannot decrypt the HTTPS payload to inspect the application signatures. Enabling an 'ssl-ssh-profile' with deep inspection on the policy allows the FortiGate to decrypt the traffic, apply the application control profile, and effectively block social media applications.

Answer

Set application control to proxy-based inspection

Answer

Enable 'allow-ssl-inspection' under system settings

Answer

Add a DNS filter to block social media domains

Question 6

An organization uses FortiWeb to protect its web applications. The security team wants to block requests that contain a specific custom pattern in the URL. Which feature should be used?

Accepted Answer

Custom Attack Signature. Custom Attack Signatures in FortiWeb allow administrators to define user-specific patterns to match against HTTP request elements, including the URL. This feature is designed to block requests containing custom patterns, such as a specific string in the URL, by inspecting the request and triggering an action (e.g., alert or block) when the pattern is matched. Unlike other features, Custom Attack Signatures provide the granularity needed to detect and block arbitrary, organization-defined patterns in the URL.

Answer

Inline Protection Profile

Answer

URL Access Rule

Answer

Web Application Firewall Policy

Question 7

A FortiGate administrator wants to use FortiAnalyzer to view traffic logs from multiple VDOMs. Which TWO steps must the administrator perform on FortiAnalyzer?

Accepted Answer

Add the FortiGate as a device in FortiAnalyzer. Option B is correct because FortiAnalyzer can only receive, index, and display logs from a FortiGate after that FortiGate has been added as a managed device (via the device registration/authorization process), which establishes the log-receiving relationship. Option D is correct because the FortiGate must be configured to send its logs to FortiAnalyzer, typically by enabling logging to FortiAnalyzer under config log fortianalyzer setting and pointing it at the FortiAnalyzer IP, so that traffic logs from all VDOMs are actually transmitted. Options A and E are incorrect because FortiAnalyzer is a log management and analytics appliance, not a traffic-inspecting firewall, so it does not require security profiles or a built-in firewall to view logs. Option C is incorrect because a single ADOM can contain the FortiGate and its multiple VDOMs; separate ADOMs per VDOM are not required to view multi-VDOM traffic logs.

Answer

Install a security profile on FortiAnalyzer

Answer

Create a separate ADOM for each VDOM

Answer

Enable FortiAnalyzer's built-in firewall

Question 8

What is the primary purpose of Content Disarm and Reconstruction (CDR) in advanced antivirus protection?

Accepted Answer

To reconstruct files by removing potentially malicious active content such as macros and scripts. Content Disarm and Reconstruction (CDR) is designed to proactively neutralize threats by stripping or disabling potentially dangerous active content—such as macros, scripts, and embedded objects—from files while preserving the file's usability. Unlike signature-based detection, CDR does not rely on known threat signatures; instead, it reconstructs the file in a safe state, removing any elements that could execute malicious code. This makes CDR a zero-day prevention technique that blocks threats before they can be analyzed or detected by traditional methods.

Answer

To detect and block known malware using signature-based detection

Answer

To submit files to FortiSandbox for behavioral analysis

Answer

To encrypt files in transit to prevent interception

Question 9

An administrator is configuring FortiMail to improve email security. Which three of the following features are part of FortiMail's advanced threat protection? (Choose three.)

Accepted Answer

Email Authentication (SPF, DKIM, DMARC). Email Authentication (SPF, DKIM, DMARC) (C) is correct because FortiMail validates sender identity by checking SPF records, verifying DKIM signatures, and enforcing DMARC policy to block spoofed and phishing messages. Content Disarm and Reconstruction (CDR) (D) is correct because FortiMail can sanitize attachments by stripping active content and rebuilding files into safe, usable versions, neutralizing embedded threats. Sandboxing (E) is correct because FortiMail integrates with FortiSandbox to detonate suspicious attachments and URLs in an isolated environment and quarantine zero-day malware. Web Filtering (A) and Application Control (B) are not part of FortiMail's advanced email threat protection; those are FortiGate/NGFW security profiles that inspect web traffic and applications rather than email-borne threats.

Answer

Web Filtering

Answer

Application Control

Question 10

A FortiGate is configured with two WAN interfaces in an SD-WAN zone. The administrator wants to ensure that Voice over IP (VoIP) traffic uses the link with the lowest latency, while all other traffic uses the link with the highest available bandwidth. The performance SLA 'VoIP_SLA' monitors latency to a VoIP provider. Which SD-WAN configuration should the administrator implement to meet these requirements?

Accepted Answer

Create an SD-WAN rule with the 'lowest-latency' algorithm, referencing the VoIP_SLA, and apply it to VoIP traffic; create a second rule with the 'maximize-bandwidth' algorithm for all other traffic.. The correct configuration uses an SD-WAN rule with the 'lowest-latency' algorithm for VoIP traffic, which selects the WAN member with the lowest latency as measured by the performance SLA. For all other traffic, a rule with the 'maximize-bandwidth' algorithm selects the member with the highest available bandwidth. This combination satisfies both requirements.

Answer

Create an SD-WAN rule with the 'lowest-latency' algorithm, referencing the VoIP_SLA, and apply it to VoIP traffic; create a second rule with the 'lowest-cost' algorithm for all other traffic.

Answer

Create an SD-WAN rule with the 'lowest-cost' algorithm, referencing the VoIP_SLA, and apply it to VoIP traffic; create a second rule with the 'maximize-bandwidth' algorithm for all other traffic.

Answer

Create an SD-WAN rule with the 'lowest-jitter' algorithm, referencing the VoIP_SLA, and apply it to VoIP traffic; create a second rule with the 'maximize-bandwidth' algorithm for all other traffic.

Question 11

An administrator has deployed a FortiGate in an SD-WAN hub-and-spoke topology. Spoke sites use IPsec tunnels to the hub, and the hub advertises a default route to the spokes. The administrator wants traffic from any spoke to another spoke to flow through the hub without requiring additional tunnels between spokes. Which SD-WAN feature should be configured on the hub to achieve this?

Accepted Answer

Configure ADVPN on the hub and spokes, and enable 'set auto-discovery' on the IPsec phase1-interface.. ADVPN enables dynamic spoke-to-spoke tunnels through a hub, allowing traffic to initially flow via the hub and then directly between spokes. Enabling auto-discovery on the IPsec phase1-interface is the key step to activate this behavior. Other options either preserve sessions, add static routes without dynamic tunneling, or configure routing protocols that do not create the necessary overlay shortcuts.

Answer

Enable 'set preserve-session-route' on the hub's SD-WAN zone.

Answer

Enable 'set exchange-interface-ip' on the hub's IPsec tunnels and configure BGP with route reflection.

Answer

Create a static route on each spoke pointing to the hub for all remote spoke subnets.

Question 12

An administrator is troubleshooting an SD-WAN rule that is not matching traffic as expected. The rule is configured with a source address of 'all', destination '10.0.0.0/24', and service 'HTTP'. The rule is placed after a rule that matches all traffic to '10.0.0.0/24' with service 'ALL'. The administrator notices that HTTP traffic to 10.0.0.0/24 is being handled by the first rule. What is the most likely cause?

Accepted Answer

SD-WAN rules are evaluated in order, and the first matching rule is applied. The rule with service 'ALL' matches HTTP traffic, so it takes precedence.. SD-WAN rules are processed in the order they are listed, and the first rule that matches the traffic is used. In this case, the rule with service 'ALL' matches HTTP traffic before the HTTP-specific rule is evaluated. The solution is to move the HTTP rule above the generic rule.

Answer

The SD-WAN rule with service 'ALL' has a higher priority value, which overrides the order of rules.

Answer

The HTTP rule is not matching because the service 'HTTP' is not defined in the SD-WAN rule; the administrator must use 'ALL' for web traffic.

Answer

SD-WAN rules are evaluated based on the most specific match, so the HTTP rule should take precedence regardless of order.

Question 13

An administrator has deployed a FortiGate at a branch with two WAN links: port1 (primary) and port2 (backup). They create an SD-WAN zone and a performance SLA named 'ISP-Health' that monitors 8.8.8.8 using ping. The SLA is configured with link-cost-factor latency and a threshold of 50 ms. After a week, they notice that the primary link is still being used for all traffic even though its latency frequently exceeds 150 ms. The backup link has 20 ms latency. What is the most likely reason the SD-WAN rule is not failing over?

Accepted Answer

The performance SLA is not referenced in the SD-WAN rule, so the rule cannot use the SLA status to make decisions.. The SD-WAN rule must explicitly reference the performance SLA for the FortiGate to use SLA results in path selection. Without that association, the rule falls back to static criteria such as interface priority or link cost, so the primary link continues to be used even when its latency exceeds the threshold. The administrator needs to edit the rule and select the SLA as a target.

Answer

The SD-WAN rule is using the 'lowest-cost' algorithm, which ignores SLA status and only uses link cost.

Answer

The SLA monitor uses ping, which is not supported for latency measurement; only HTTP and TCP echo are valid.

Answer

The link-cost-factor is set to latency, but the backup link must also have an SLA configured to be eligible for failover.

Question 14

An administrator has configured a FortiGate with two VRF instances: VRF10 and VRF20. They need to allow a server in VRF10 (10.10.10.0/24) to communicate with a server in VRF20 (10.20.20.0/24). The administrator creates a firewall policy with source interface VRF10 and destination interface VRF20, but traffic is not passing. What is the most likely cause?

Accepted Answer

VRF instances are isolated by default; inter-VRF traffic requires a static route or policy route to leak routes between VRFs.. FortiGate VRF instances have separate routing tables. To allow traffic between them, the administrator must configure route leaking, typically by adding a static route in each VRF that points to the other VRF's interface or using policy routes. Without these routes, the FortiGate will drop packets even if a firewall policy permits them, because it cannot determine the next hop for the destination network.

Answer

The firewall policy must have 'match-vip' enabled to allow traffic between different VRFs.

Answer

Inter-VRF traffic is only supported when using VXLAN tunnels between the VRFs.

Answer

VRF instances require the use of 'set vrf' in the firewall policy to specify the source and destination VRFs.

Question 15

An administrator is configuring an SD-WAN rule to route VoIP traffic over the most reliable link. The performance SLA monitors latency, jitter, and packet loss. The administrator wants the rule to select the member with the lowest jitter that also meets the SLA thresholds. Which SD-WAN strategy should be used?

Accepted Answer

lowest-jitter (SLA). For VoIP, jitter is a critical metric. The lowest-jitter (SLA) strategy chooses the member with the lowest jitter among those passing the SLA. Other strategies focus on cost, bandwidth, or latency, which do not directly address the need for minimal jitter.

Answer

maximize-bandwidth (SLA)

Answer

lowest-latency (SLA)

Answer

lowest-cost (SLA)